Is there a patch available for CVE-2026-93269?

Yes, a patch is available for CVE-2026-93269. Update the affected software to the latest version immediately.

Linux CVE-2026-93269

EUVD-2026-86141

2026-09-24 Linux

GHSA-9p82-h2x3-6rrv

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix circular lock dependency in ext4_ext_migrate

Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (freeze protection).

The deadlock scenario:

CPU0 (EXT4_IOC_MIGRATE) CPU1 (orphan cleanup during mount) ---- ---- ext4_ext_migrate() ext4_writepages_down_write() s_writepages_rwsem (write) ext4_evict_inode() sb_start_intwrite() [sb_internal] ... ext4_writepages() s_writepages_rwsem (read) [BLOCKED] iput(tmp_inode) ext4_evict_inode() sb_start_intwrite() [BLOCKED]

The tmp_inode is a temporary inode with nlink=0 created solely for building the extent tree. Its eviction does not require s_writepages_rwsem protection, so deferring iput() until after releasing the rwsem is safe.

Affected VersionsENISA

Linux cb85f4d23f794e24127f3e562cb3b54b0803f456 <a897682793eba5de51ee6f3152760374afa629cf

Linux patch: 6.18.52

Linux cb85f4d23f794e24127f3e562cb3b54b0803f456 <452950461241dfed8b1d32e94b227db38c99c5af

Linux cb85f4d23f794e24127f3e562cb3b54b0803f456 <ada23457d4748d6e9c36c6f871fc29a6f558c48c

Linux eb799e163dc2bc1ea0a4820b66f79d32a5e907df

Linux 4.9.215 <4.10

Linux 5.6

Linux 69f8a7991fd93c49096ddd11574db3e7df238b7b

Linux patch: 7.3-rc1

Linux patch: 0

Linux cb85f4d23f794e24127f3e562cb3b54b0803f456 <e4223231b6860141813637a6413c2371ae4d6fa8

Linux 8cf20fb73e73a4c4df0328b5297842c5ef34fdd9

Linux bcc1eab71a67c46b9e24544ac7923f44444174ce

Linux patch: 6.12.110

Linux cb85f4d23f794e24127f3e562cb3b54b0803f456 <32f7ab52875ec7f800ca67e7176e5743a84baddf

Linux patch: 6.6.157

Linux e5d25003d059649e18a249635ed5ca7a7b1de5ad

Linux 4.19.107 <4.20

Linux 5.5.7 <5.6

Linux 4.14.172 <4.15

Linux patch: 7.2.6

Linux 5.4.23 <5.5

Affected Packages

euvd linux fix: 4.10, 4.15, 4.20, 5.5, 5.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Sep 24, 2026 - 17:03 EUVD

CVE Published

Sep 24, 2026 - 15:52 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

CVE.org

EPSS MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.